General Disclaimer 


One or more of the Following Statements may affect this Document 


• This document has been reproduced from the best copy furnished by the 
organizational source. It is being released in the interest of making available as 
much information as possible. 


• This document may contain data, which exceeds the sheet parameters. It was 
furnished in this condition by the organizational source and is the best copy 
available. 


• This document may contain tone-on-tone or color graphs, charts and/or pictures, 
which have been reproduced in black and white. 


• This document is paginated as submitted by the original source. 


• Portions of this document are not fully legible due to the historical nature of some 
of the material. However, it is the best reproduction available from the original 
submission. 


Produced by the NASA Center for Aerospace Information (CASI) 



NASA Contractor Report 144865 


DESCRIPTION AND THEORY OF OPERATION OF THE COMPUTER BY-PASS 
SYSTEM FOR THE NASA F-8 DIGITAL FLY-BY -WIRE CONTROL SYSTEM 


Sperry Flight Systems 
Phoenix, Arizona 


(HASA-CR-1 44865) DESCRIPTION AMD THEORY OF S78-22076 

OPERATION OF THE COMPUTER BY-PASS SYSTEM FOE 
THE HASA F-8 DIGITAL FLY-BY-MIRE COHTBOL 

SYSTEM Final Report {Sperry Flight Systeas, One las 

Phoenix, Ariz.) 99 p HC A05/HF A01 CSCLJMC G3/05 16676 


May 1978 


NAS4-2248 


iwvsa 

National Aeronautics and 
Space Administration 

Hugh L Dryden Right Research Center 

PO Box 27? 

Edwards California 93523 
AC 805 258-3311 


TABLE OF CONTENTS 


Page 


INTRODUCTION 1 

GENERAL SYSTEM DESCRIPTION 5 

Servo Control System 5 

General Switching Configuration 10 

Computer Bypass Function 13 

Self-Test Function 13 

SYSTQi OPERATION 15 

Digital System Interface 15 

Computer Bypass Operation 28 

Servo Redundancy Management and Engagement Interlocks 34 

Self-Test Operation 36 

SYSTEM DESIGN FEATURES 38 

Pilot Control Inputs and Processing 38 

Digital System Inputs and Processing 40 

Computer Bypass Trim System 41 

Command Channel Equalization and Synchronization 42 

Command Channel Voting 43 

Command Channel Redundancy Management and Mode Control 44 

Servo Engage Interlocks 45 

Servo Control System Design 46 

Self-Test Design Philosophy 56 


1 


TABLE OF CONTENTS (CONT) 


Page 

HARDWARE DESCRIPTION 58 

Bypass and Servo Electronics 58 

Status/Engage Panel 59 

APPENDIX A. PREFLIGHT SELF-TEST TABLE 63 

APPENDIX B. COMPARATOR STATUS CHECK TABLE FOR SELF -TEST 89 


ii 


ILLUSTRATIONS 


Page 


1. Simplified F-8 DFBW computer bypass and servo electronics 2 

system block diagram 

2. F-8 DFBW triplex secondary servo functional block diagram 7 

3. Status/engage panel 11 

4. Manual engage MVL logic 12 

5. Triplex elevator command interface block diagram 14 

6. Yaw axis CBS/DCS analog block diagram - CH A 17 

7. Pitch axis CBS/DCS analog block diagram - CH A 19 

8. Roll axis CBS/DCS analog block diagram - CH A 21 

9. Pitch axis functional logic diagram 23 

10. Roll axis functional logic diagram 24 

11. Yaw axis functional logic diagram 25 

12. Pitch stick command in VAC versus pitch stick displacement 30 

in centimeter 

13. Elevator surface command in VDC versus surface position 32 

in degrees 

14. Pre-flight self-test block diagram 39 

15. F-8 DFBW secondary actuator transfer function block diagram 47 

16. Secondary actuator open loop Bode plot of position loop 49 

17. Response of triplex system, actuator S/N 001 to an 50 

equivalent ±2 degrees 6 step 

18. Closed loop Bode plot for actuator S/N 001 51 

19. Open loop Bode plot of pressure loop 55 

20. Bypass and servo electronics assembly outline drawing 60 

21. Status/engage panel outline drawing 61 


ill 


TABLES 


1. 

Servo actuator solenoid engagement switching sequence 

Page 

11 

2. 

Electronic and PEM comparator trip levels 

A5 

A-1. 

Self-test 

table 

65 

A-2. 

Self-test 

table 

66 

A-3. 

Self-test 

table 

67 

A-4. 

Self-test 

table 

68 

A-5. 

Self- test 

tab le 

69 

A-6. 

Self-test 

table 

70 

A-7. 

Self-test 

table 

71 

A-8. 

Self-test 

table 

72 

A-9 . 

Self-test 

table 

73 

A- 10. 

Self-test 

table 

74 

Aril. 

Self-test 

table 

75 

A-12. 

Self-test 

table 

76 

A-1 3. 

Self-test 

table 

77 

A-14. 

Self-test 

table 

78 

A-15. 

Self-test 

table 

79 

A-1 6. 

Self-test 

table 

80 

A- 17. 

Self-test 

table 

81 

A-1 8. 

Self-test 

table 

82 

A-19. 

Self-test 

table 

83 

A-20. 

Self-test 

table 

84 

A-21 . 

Self-test 

table 

85 

A-22. 

Self-test 

table 

86 

A-23. 

Self-test 

table 

87 


iv 


TABLES (cont) 


Page 


A-24* 

Self-test table 



88 

B-1 . 

Comparator status 

check 

table - pitch axis 

90 

B-2. 

Comparator status 

check 

table - roll axis 

91 

B-3. 

Comparator status 

check 

table - yaw axis 

92 


DESCRIPTION AND THEORY OF OPERATION 
OF THE 

COMPUTER BYPASS SYSTB1 FOR THE NASA F-8 
DIGITAL FLY-BY-WIRE CONTROL SYSTM 


Prepared by 
Sperry Flight Systems 

INTRODUCTION 


The main objective of the phase II digital fly-by-wire (DFBW) program 
was to evaluate a triplex redundant DFBW flight control system. The single 
channel digital flight control computer used in phase I of the program was 
replaced in phase II by a triplex redundant digital flight control system 
configuration* 

A simplified block diagram of the signal flow for a single channel is 
shown in figure l. Although this block diagram does not show the complete 
triplex system* it illustrates the manner in which a single channel oper- 
ates. The system may be engaged in the manual or auto mode via the status/ 
engage panel. When engaged* the engage signal flows to the bypass and servo 
electronics (BASE) units for monitoring and routing to the secondary actu- 
ator solenoids. 

The pitch* roll, yaw, and trim commands from the cockpit control sensor 
flow to the computer bypass system (CBS) and to the digital computer system 
(DCS) electronics located in the BASE units. A discrete command from the 
mode and gain panel is fed to the BASE unit* d>ich sets the CBS/DCS switch 
to accept surface commands from either the CBS electronics or the DCS sys- 
tem. (At this point* although not shown, the triplex surface commands are 
cross channel monitored and the middle value surface command is selected for 
each channel.) 



Figure 1. Simplified F-8 DFBW computer bypass and servo electronics system 
block diagram. 
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The surface commands from either the CBS or DCS system are then routed 
to the secondary servo electronics for surface positioning* Synchronization 
is provided to force the CBS surface commands to equal the DCS surface com- 
mands while the flight control system is in a DCS mode to reduce surface 
transients when dovnmoding from DCS to CBS. Triplex failure monitoring is 
provided in the BASE units, and detected failures are reported on the 
status/engage panel. 

Self-test is an automated closed loop ground test which Injects stimuli 
into strategic points in the BASE units and reads the desired results 
through the normal failure annunciation path. 

In summary, the BASE units of the Sperry Flight Systems (SFS) -supplied 
equipment provide DCS surface command buffering, computer bypass system 
electronics, failure monitoring and engage logic, CBS/DCS switching and 
middle value logic selection, trim, synchronization, and equalization, and 
secondary servo electronics for both the DCS and CBS flight control modes. 
The status/engage panel of the SFS-supplied equipment provides servo engage 
switches, failure annunciation, and self-test. 

Triplex operation is described in detail later in this report. For tri- 
plex operation, there are three DCS systems, three BASE units, and one 
status/engage panel. The single status/engage panel services all three BASE 
units. Separate aircraft sensors are provided for each triplex channel. 
Cross channel (between BASE units) referencing for triplex operation is per- 
formed for surface command middle value selection, failure monitoring, and 
secondary actuator pressure signal middle value selection. 

Under this contract, Sperry Flight Systems delivered the following units 
to NASA: one status/engage panel breadboard, two status/engage panel fly- 

able units, three bypass and servo electronic breadboards, three bypass and 
servo electronic flyable units, and one complete set of spare cards for the 
bypass and servo electronics flyable units. 
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SYMBOLS /ABBREVIATIONS LIST 


A - Not A 

ADI - Attitude Direction Indicator 

AMP - Amplifier 

ASSY - Assembly 

AUTO - Automatic 

BASE - Bypass and Servo 
Electronics 

C - Comparator Status 

CAS - Command Augmentation System 

CBS - Computer Bypass System 

CE - Control Electronics 

CH - Channel 

CLE - Comparator Status of Left 
Electronics 

CM - Centimeter 

CMD - Command 

COMP - Computer 

CPEM - Comparator Pre-Engage 
Monitor 

CRE - Comparator Status of 
Right Electronics 

db - Decibel 

DCS - Digital Computer System 
DEG - Degree 

DFBW - Digital Fly-by-Wlre 
DIR - Direct Mode 


DN - Down 

E - Electronics 

ENG - Engage 

EQUAL - Equalization 

F - Failure 

FDBK - Feedback 

FLT - Flight 

G - Good 

Hz - Frequency 

IN/SEC - Inch per Second 

INTEG - Integrate 

L - Left 

LRU - Line Replaceable Unit 

LSB - Least Significant Bit 

LVDT - Linear Voltage Differential 
Transmitter 

ma - Mil 11 amps 

MS - Milliseconds 

MSEC - Milliseconds 

MVL - mid-value logic 

N/A - Not Applicable 

NASA - National Aeronautics and 
Space Administration 

P - Pitch 

PEM - Pre-Engage Monitor 
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SYMBOLS /ABBREVIATIONS LIST (CONT) 


POT - Potentiometer 

PSI - Pressure per Square Inch 

R - Right 

RAM - Random Access Memory 
RRS - Roll Right Servo 
S - Laplace Operator 
S - Servo 

SAS - Stability Augmentation System 
SEC - Second 

STS - Sperry Flight Systems 


TIP - Test Input Point 
TMP - Test Monitor Point 

V ac - Volts ac 

V dc - Volts dc 

VRMS - Volts Root Mean Square 

V - v aw 

P - Differentia? Pressure 

<5g, <5 a , <5 r - Elevator, Ailerons, 
Rudder 

^E»» ^En* ^Er ” Control Surface 
A Commands to Surface 

Actuators 


Detail descriptions of the system as a whole and system operation appear 
in later sections of this report* A description of the preflight self-test 
procedures is Included as appendix A, and a comparator status check table 
during self-test is included in appendix B* 


GENERAL SYSTEM DESCRIPTION 


SERVO CONTROL SYSTEM 


The F-8 secondary actuator is a triple force-summing tandem analog servo 
with both large output force capability and large system bandwidth* As 
such, it is capable of responding rapidly to input commands in the presence 
of any practical actuator operating load. The system redundancy features 
Include triplex servo valves, electronics, position LVDT, and differential 
pressure sensors* The aircraft hydraulics system is triplex* Three dc 
buses and their associated Inverters provide the necessary power for each 
servo channel* In the normal operating mode, these buses are fed by the 
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flight control system dc generator via Isolating diodes* Separate 28-volt 
batteries power each bus If generator power is lost* 

The force output of each channel of a secondary actuator Is developed 
across Its respective pist' n* These pistons are cast In a single mechanical 
ram so that the forces produced by each piston are algebraically summed to 
drive the load* The Inertial portion of the load consists of the sliding 
valve 8 pool of the power boost servo and the associated mechanical linkages 
that connect the ram to the spool* Other opposing forces Include actuator 
stlction, sliding friction effects, and Bernoulli forces on the main valve 
8 pool during load motion* If one of the servo channels falls, the monitor- 
ing system, upon sensing the failure, deactivates the appropriate engage 
solenoid. This results in the channels being hydraulically bypassed. The 
other two channels are then able to move the load without any opposition 
from the failed channel. Under two-channel operation, system performance 
remains essentially unchanged. 

Five identical secondary actuators are associated with the F-8 fly-by- 
wire airplane* These Include the left and right elevator actuators, the 
left and right flaperon actuators, and the rudder secondary actuator* Fig- 
ure 2 is a functional block diagram of the typical closed loop system, but 
shows only a single channel of the triplex system. A diagram of the com- 
plete system would Include a triplication of all blocks of figure 2 except 
those between the force summing point and the actuator output* A general 
description of the secondary actuator servo system design and operation Is 
given In the following paragraphs. 

Actuator servo Input commands can originate from two sources* In the 
primary mode of operation the digital system provides these commands via Its 
dlgltsl-to-analog conversion electronics. In the back-up mode, these com- 
mands originate from the sensors of the pilot cockpit controls* In either 
case, the command is routed to the servo amplifier via the mid-value logic 
(MVL), which selects the mid-value of the three command signals* One MVL 
command circuit Is associated with each channel of the triplex actuator* 
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The MVL Input command at the servo amplifier is summed with the pressure and 
position feedback signals* The position loop is the dominant control loop 
that determines the basic dynamic response of the system. Differences be- 
tween command and feedback signals are amplified in the servo summing ampli- 
fier and driver, and the resulting signal constitutes the driving signal to 
the servo valve. The latter is a two-stage electrohydraulic flapper valve. 
Initially, the servo amplifier error signal causes the valve to develop a 
differential pressure, AP, across the piston. This pressure, times the 
piston area, results in a force across the piston of each channel. These 
forces are summed in the ram, and after overcoming the effects of actuator 
stictlon, the resultant force moves the inertial load. As the load moves, 
the Inherent valve pressure to flow feedback characteristic reduces the 
pressure across the ram, while the linear voltage differential transmitter 
position signal cancels the MVL position command. In the steady state, when 
the ram comes to rest, the position and command signals cancel each other. 
For all intents and purposes this cancellation is exact, since the position 
feedback and command signals track each other to better than • 1 percent 
under normal operating conditions. 

As suggested in Figure 2, the position feedback signal from the LVDT is 
ac in nature. This signal is demodulated, and to reduce ripple to a toler- 
able level a two stage roll-off filter is provided. Additional high fre- 
quency filtering is included in the servo amplifier electronics to stabilize 
the design of this amplifier. The resulting closed loop dynamics of the 
servo approximates that of a second order system having a relative damping 
ratio of approximately .7 and a natural frequency of 20 Hertz. 

In order to realize the full potential of a triplex force summing servo, 
pressure equalization feedback is introduced. The introduction of this 
feedback path serves to reduce force fights among the three channels to 
acceptable levels, thereby providing the capability to monitor the servo 
system. Without equalization, relatively small system nulls and tolerances 
would result in the generation of opposing forces across the individual 
pistons* While not affecting performance significantly, this could result 
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in the effective loss of the means to detect faults in the system design, 
thereby compromising the "fail-operational/ fail-passive" capability* 

Figure 2 illustrates the pressure feedback system used in the F-8 sec- 
ondary actuator design* The pressure across each piston is sensed by a dc 
transducer* Hie sensor's low level signal, 60 millivolts for 20*68 x 10& 
N/m^ (3000 psi), is amplified and the high frequency noise filtered* The 
signal then passes through a dead zone and limiter circuit which is Inserted 
primarily to offset the adverse effects of servo valve nonllnearltles* The 
shaped signal is then routed to the MVL, where the mid-value among the three 
different channel pressures is selected as the reference for each channel* 
This mid-value pressure is compared with the individual channel pressure and 
the difference between the two signals is used as the pressure equalization 
feedback* The feedback in that channel with the mid-value pressure auto- 
matically has a zero feedback command at that moment* This is because the 
output voltage signal from the MVL circuit is identical to the input signal, 
for the case that the input is the mid value* Therefore, the difference, 
which constitutes the feedback, is zero. The signal representing the 
pressure difference is then operated upon by a nonlinear first-order lag 
circuit which shapes the feedback signal, and controls the pressure loop 
stability and bandwidth. The rate of signal build up at the output of this 
lag is limited whenever the signal magnitude exceeds a prescribed level. 

This assists in detecting passive or open system failures* The output 
signal of the nonlinear lag is limited to approximately S percent of servo 
position authority before being summed with the other servo amplifier com- 
mands. In order to provide system failure monitoring capability* individual 
channel pressures and the mid-value pressure are compared. When the differ- 
ence between these two signals exceeds a specified level for some minimum 
time* the servo channel is disengaged and hydraulically bypassed. System 
operation then proceeds on a two channel basis. 

Figure 2 shows servo amplifier and pressure feedback balance potentiom- 
eters, which are adjusted to null each channel when the system is initially 
turned on. In addition, the servo balance potentiometer provides sufficient 
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range to null the system in the presence of any Intentional unbalance ef- 
fects* The latter can be introduced, as is the case for this system, by 
biasing the LVDT position feedback signal in order to more readily detect 
passive failures in the position feedback loop. 

GENERAL SWITCHING CONFIGURATION 


Servo Actuator Engagement 

The F-8 DFBW is a triplex redundant system with servo actuators for the 
left aileron, right aileron, left elevator, right elevator, and rudder. 

These actuators have three channels each (A, B, and C which engage and con- 
trol them) and are engaged through the status /engage panel located on the 
pilot's left hand console (fig. 3). There are 15 engage switches, with 
status lights located above each switch to inform the pilot which channel is 
engaged* Three positions are provided for each switch; auto, manual, and 
off. Engaging one of the three channels in manual inhibits and locks out 
the other two channels from engaging. An example of the switching sequence 
is provided in table 1. It should be noted that the engagement of the left 
elevator is Independent from the engagement of the right elevator; this is 
also true for the left and right ailerons. 

Manual engagement is provided in order to preflight each channel for 
Independent, proper operation before every flight. Manual engagement over- 
rides all surface command monitoring and servo actuator monitoring disable 
logic. Manual engagement also disables surface command MVL select, so that 
whatever surface command is Injected into that channel becomes the position 
command for that actuator. This is different from auto engage, which com- 
pares the surface command from all three channels and selects the middle 
value as the position command for all three channels. See figure 4 for an 
example of this logic. Auto engage also provides full monitoring and 
disable logic. 


10 





Figure 3. Status/engage panel. 


TABLE 1. SERVO ACTUATOR SOLENOID ENGAGEMENT SWITCHING 
SEQUENCE EXAMPLE* 


Channel A 
switch 
position 

Channel B 
switch 
position 

Channel C 
switch 
position 

Channel A 
actuator 

Channel B 
actuator 

Channel C 
actuator 

Off 

Off 

Off 

Off 

Off 

Off 

Auto 

Off 

Off 

On 

Off 

Off 

Auto 

Auto 

Off 

On 

On 

Off 

Auto 

Auto 

Auto 

On 

On 

On 

Manual 

Auto 

Auto 

On 

Off 

Off 

Manual 

Manual 

Auto 

On 

Off 

Off 

Manual 

Manual 

Manual 

On 

Off 

Off 

- - 


♦Channel switch position sequence A-B-C. 
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ENABLE 
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SOLENOID SWITCH 
IN AUTO OR OFF 


Figure 4. 


Manual engage MVL logic. 







CBS or DCS Engage 


The pilot has the option of selecting any of the digital control system 
modes (direct* SAS, or CAS) or the computer bypass system* The mode Is 
selected on the mode and gain panel* tfilch Is located on the pilot's instru- 
ment panel directly above the Attitude Direction Indicator (ADI)* Selecting 
either of the CBS or one of the DCS modes in one or all of the three aircraft 
axes (pitch* roll* and yav) commands all channels (A* B, and C) to respond to 
that mode* For example* If the pilot selects pitch direct* roll CBS* and yav 
CBS* all three bypass and servo electronics boxes (channels A* B* and C) re- 
spond to pitch commands from the three computers only. Roll and yaw commands 
from the computer are rejected* and only commands from the CBS are accepted. 

An interface block diagram of the elevator command from the stick to the sur- 
face actuator (aileron and rudder would be similar) Is shown In figure 5* 

COMPUTER BYPASS FUNCTION 

The DCS Is considered to be the primary system; the CBS provides the pilot 
with a backup system* Redundancy management of the three channels Is handled 
In the bypass and servo electronics box for both the CBS and the DCS. While 
In the DCS mode* failure monitor logic can downmode an axis from DCS to CBS. 
However, failure monitor logic does not upmode an axis from CBS to DCS; It 
only shuts off a channel or actuator* Further discussion on failure monitor 
logic Is discussed in SYSTEM OPERATION and SYSTEM DESIGN FEATURES . 

SELF-TEST FUNCTION 


The purpose of the preflight self-test is to verify the Integrity of the 
triplex redundant BASE, the interface between the triplex redundant DCS and 
the triplex redundant CBS* and the triplex redundant secondary hydraulic servo 
actuator for the digital fly-by-vlre flight control system. 
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Figure 5. Triplex elevator command interface block diagram (DCS engaged) . 
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SYSTEM OPERATION 


DIGITAL SYSTEM INTERFACE 

In addition to a computer valid discrete to the backup and servo control 
system, all three computers provide pitch, yaw, roll symmetric, and roll 
asymmetric surface commands* The backup and servo control system processes 
these signals, selects the middle value surface command for each axis, and 
drives all three channels of the secondary actuator In parallel. The backup 
and servo control system also provides the redundancy management monitoring 
to assure that each channel tracks within a specified window of the middle 
surface command value. Synchronization Is provided to ensure that the CBS 
always has a command equal in value to the DCS middle value surface command, 
so that if an axis is downmoded from DCS to CBS, there is a minimum of sur- 
face transient. 


Digital System Engagement 

Upon initial power on, the backup and servo control system is reset to 
the CBS mode. Rigagement In a DCS mode requires several criteria to be met. 
The sequence of operation would be as follows: The pilot pushes the DIR 

button on the mode and gain panel for the chosen axis. This results in a 
digital engage request to the backup and servo control system. The Bystem 
then starts its search for two computer vallds and a digital engage latch. 
(The electronic comparators need not be valid at this time.) If there is a 
digital engage latch signal and two computers are valid, two parallel opera- 
tions occur. The switch which controls whether a CBS or a DCS surface 
command is to be accepted is set to the DCS position, provided that the 
electronic comparator for the channel Is valid and that the computer for 
that channel Is valid. The other operation is that one shot is triggered 
which enables the MVL (triplex voter) and attempts to reset the electronic 
comparators for that axis. If the reset is successful, and either two left 
or two right electronic comparators for that axis report a valid state, the 
system latches up Into the DCS mode and the DIR button can be released. The 
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entire sequence takes 15 milliseconds or less, depending on whether the 
electronic comparators are valid prior to upmoding, since there is a 
15-millisecond delay prior to resetting the electronic comparators* 

As previously mentioned, the latch signal is disabled either by pushing 
the CBS button on the mode and gain panel for that axis, or by depressing 
the paddle switch on the pilot's control stick, which downmodes all axes to 
the CBS mode. 

The backup and servo control system searches for two computer vallds and 
two electronic comparator valids; this is the underlying principle behind 
the triplex redundancy monitoring system (the two-out-of-three-valid prin- 
ciple)* Since middle value logic is used for the surface command, it takes 
two valid commands to give a reliable middle value command* Therefore, if 
two computers report that they are invalid (their commands are unreliable), 
or if two electronic comparators detect two surface commands which are out- 
side the specified window of the middle value command (the correct command 
is undeterminable), then the backup and servo control system does not allow 
an upmode since the commands are unreliable* 

The backup and servo control system reports to both the mode and gain 
panel and to the computers of a DCS mode engagement* 

Digital Computer System Surface Drive Commands 

Yaw digital computer system command * - In reference to figure 6, the yaw 
DCS command is delivered from the three computers to their respective chan- 
nels in the backup and servo control system. This signal is processed 
through a second-order, low-pass filter with a break frequency of 50 radians 
per second, and then scaled up by a gain of 2 and command limited to ±20.7 
degrees of rudder surface deflection* The signal is then delivered to the 
CBS/DCS solid state switch which controls whether or not this signal can 
pass through to the middle value logic block. From this point the signal is 
fed to the middle value logic block in each of the three channels for 
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Figure 6 


Yaw axis CBS/DCS analog block diagram - channel A 
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comparison and middle value selection* The middle command value is then 
limited to ±10*0 degrees of rudder deflection if the wing Is down* A dis- 
crete signal Is provided by one of the three Independent wing position 
switches located under the wing* If the wing Is up, the signal Is not 
limited and the entire signal Is passed through to the closed loop drive 
which Is scaled at 2*10 degrees per volt* This mathematical equation is: 
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Pitch digital computer surface command . - In reference to figure 7, the 
pitch DCS command is received in each channel and processed through a 
second-order, low-pass filter with a break frequency of 50 radians per 
second, and then scaled up by a gain of 2 and command limited to 24.8 de- 
grees of elevator leading edge down, and 5.57 degrees of leading edge up 
travel* The signal then takes two parallel paths; one path Is for the left 
elevator actuator and one is for the right actuator* Each parallel path is 
first delivered to its respective CBS/DCS switch. This switch, %*\lch Is 
controlled by logic, determines whether or not the DCS signal passes through 
to the middle value logic block. From this point the signal Is fed to the 
middle value logic block in each channel for comparison and middle value 
selection* The middle value signal Is then used as the position command for 
the closed loop servo drive, which has an approximate gain of 2*40 degrees 
per volt. This mathematical equation Is: 
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Further gearing and signal shaping between the pilot's control stick and the 
backup and servo control system is provided by the computer In software. An 
elevator position signal for each channel is fed back to its respective 
conputer. 
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Roll digital computer system command * - The three computers each supply 
a DCS symmetric aileron command and a DCS asymmetric aileron command to the 
backup and servo control system (figure 8). The DCS symmetric aileron 
command is normally used as a wing flap command to drive both aileron 
surface to 20 degrees trailing edge down for a wing up condition* However, 
this in under software control, and therefore is not controlled by the back- 
up and servo control system. Both aileron commands are processed through a 
second-order, low- pass filter with a break frequency of 50 radians per 
second and scaled up by a gain of 2* The DCS symmetric aileron command is 
then added to the DCS asymmetric aileron command for the right hand actuator 
signal, and subtracted from the DCS asymmetric aileron command for the left 
hand actuator signal. These composite signals are then limited to 13.9 de- 
grees of aileron trailing edge up travel and 42.9 degrees of trailing edge 
down travel. These signals are then delivered to their respective CBS/DCS 
switches, which control whether or not they pass through to the MVL block. 
From the switch, the signal is fed to the MVL block In all three channels 
for monitoring and middle value selection* The middle value conmand then 
drives the surfaces with a scale factor of 4.5 degrees per volt. The 
mathematical equation from input to surface is: 
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The DCS symmetric aileron command is subtracted from the synchronization 
circuit and added directly to the CBS circuit in the proper manner for left 
and right aileron signals. When a downmode from DCS to CBS occurs, the DCS 
symmetric aileron command is gradually faded out and the wing position com- 
mand used in the CBS mode is smoothly faded in with the some time constant 
of 1.0 second. This fadeout occurs for either a downmode, or if both CBS/ 
DCS switches for that channel are switched to the CBS mode. 


Further gearing and signal shaping between the pilot's control stick and 
the backup and servo control system is accomplished by the computer under 
software control. 
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Digital Computer System Redundancy Management Monitoring 


Redundancy management monitoring for a DCS mode consists of monitoring 
computer valid discretes , DCS surface commands , and CBS pre-engage monitor- 
ing. Figures 9, 10, and 11 are the logic functional diagrams for the pitch, 
roll, and yaw axes, respectively. 

Digital computer system surface command monitoring . - Electronic com- 
parators are used to compare a DCS channel command with the DCS middle value 
surface command. This comparator is set to trip to an invalid state if the 
surface command falls outside the specified window of ±5*96 degrees (2.84 V 
dc) of surface command for the yaw axis, ±6.82 degrees (2.84 V dc) of sur- 
face command for the pitch axis, and +10.94 degrees (2.43 V dc) of surface 
command for the roll axis. Different logical sequences of events occur, 
depending upon the number of comparators that are tripped. Examples of pos- 
sible sequences follow. 

One left and/or one right electronic comparator trip: If a failure is 

reported by one left and/or one right electr uic comparator in the pitch or 
roll axis, or one electronic comparator in the yaw axis, the CBS/DCS switch 
for that side in that channel switches to the CBS position, and synchroniza- 
tion forces that input to equal the DCS middle surface command value. Syn- 
chronization tracks the middle surface command value to +.069 V dc at a 
maximum rate of 15.4 V dc per second. The appropriate electronic warning 
light on the status/engage panel lights up to alert the pilot of a tripped 
electronic comparator. The pilot may then attempt to reset this comparator 
by pressing the illuminated electronic warning light, vrtiich is also a momen- 
tary contact switch. If the reset is successful, the light goes out and the 
CBS/ DCS switch returns to the DCS position. 

Two left or two right electronic comparator trips: If a failure is 

detected in two left or two right (but not both left and right) electronic 
comparators in the pitch or roll axis, the MVL output for that side in that 
axis is disabled for all three channels. The surfaces then automatically 
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Figure 11. Yaw axis functional logic diagram 







return to a 0 command surface deflection for the aileron surface, or 5 de- 
grees leading edge down for the elevator axis If the secondary actuator Is 
still engaged (this refers to zero surface command). All three electronic 
warning lights for that axis on the status/engage panel light up. The pilot 
may then attempt to reset the electronic comparators. If the reset is suc- 
cessful and two or three of the electronic comparators become valid, the MVL 
again becomes operative and the switches are set in the appropriate posi- 
tions depending upon whether or not their electronic comparators are valid. 
If the failure still exists, no reset is possible. 

Two left and two right electronic comparators trip: If two left and two 

right electronic comparators in the pitch or roll axis, or two electronic 
comparators in the yaw axis trip, that axis is automatically downmoded to 
the CBS mode and all the electronic comparators in that axis automatically 
receive a reset command. The pilot is informed of this action on the mode 
and gain panel when the CBS mode light comes on and the DCS mode (DIR, SAS, 
CAS) light goes off. 

Computer valid discrete monitoring . - As mentioned previously, if one 
computer is or becomes invalid, all of the CBS/DCS switches for that channel 
switch to the CBS mode. If two computers fail, all axes automatically down- 
mode to the CBS mode. However, other failures can occur while remaining in 
the DCS mode, such as one computer failure and any number of electronic com- 
parator failures up to the number required to downroode the system to the CBS 
mode. The examples following illustrate this situation. 

One left or one right electronic comparator trips and one computer 
fails: If one left or one right (but not both) electronic comparator in the 

pitch or roll axis trips, and one computer from another channel fails, the 
appropriate CBS/DCS switches switch to the CBS position and synchronization 
forces that side to equal the MVL output from the other side (within the 
boundaries of the electrical limits). The appropriate electronic light on 
the status/engage panel will light up and the pilot may attempt to reset 
that electronic comparator. 
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One left and one right electronic comparator trips and one computer 
falls: If one left and one right electronic comparator in the pitch or roll 
axis, or one electronic comparator in the yaw axis trips, and one computer 
from another channel falls, the appropriate CBS/DCS switches will switch to 
the CBS position and the appropriate electronic lights on the status/engage 
panel will light up. This situation is unusual because two left and two 
right CBS/DCS switches are in the CBS position and therefore the system is 
controlled by the CBS mode even though a downmode has not occurred. The DCS 
mode light on the mode and gain ;°nel remains illuminated. This, however, 
causes no problem, because as soon as the valid computer channels disagree 
with the backup system, the electronic comparators for that channel trip and 
properly downmode the system to the CBS mode. 

Backup system monitoring while in digital computer system mode . - 
Monitoring is provided in the DCS mode to alert the pilot of a failure in 

the backup system. This is cross channel monitoring between the CBS com- 
mands in which channel A compares with channel B, channel B compares with 

channel C, and channel C compares with channel A. This channel signal is a 

composite of CBS rudder pedal command and synchronization in the yaw axis; 
CBS pitch stick command, synchronization, and wing position in the pitch 
axis; and CBS roll stick command, synchronization, DCS symmetric aileron 
command, and wing position in the roll axis. If the channels disagree by 
more than ±5.96 degrees (2.84 V dc) of surface command in the yaw axis, 

±6.82 degrees (2.84 V dc) of surface command for the pitch axis, or ±12.78 
degrees (2.84 V dc) of surface command for the roll axis, the PEM light on 
the status/engage panel will light up, alerting the pilot of a failure in 
the backup system for that axis. The pilot may attempt to reset this com- 
parator by pressing on the illuminated light. This monitoring is only meant 
to be an alert to the pilot, and no disable logic is associated with it. 

The PEM alert warning circuitry is disabled while in the CBS mode. 
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COMPUTER BYPASS OPERATION 


The CBS is provided to give the pilot a reliable backup system in case 
of DCS malfunction or pilot desire* The CBS receives Inputs from the 
pilot's control stick, rudder pedals, manual trim commands, and wing posi- 
tion analog and discrete signals. These signals are combined and shaped in 
the appropriate manner for each axis* The middle value is then selected for 
each axis from the three channels and used to drive the three channels of 
the secondary actuator in parallel. Redundancy monitoring is provided to 
assure that each channel is tracking within a specified window of the middle 
value command. Equalization is provided to null any offset errors between 
channels. 


Yaw Computer Bypass System Surface Command 

Three LVDT signals controlled by the rudder pedals are delivered to the 
appropriate yaw channels In the backup and servo control system (figure 6). 
This signal has two scale factors: .511 volt rms per centimeter if the wing 

is down, and 1.120 volts rms per centimeter if the wing Is up. The backup 
and servo control system demodulates this signal with a scale factor of 1.00 
volt dc per volt rms with a first-order lag effect which has a break fre- 
quency of 151 radians per second. This signal is then nulled out to a 0 
degree rudder command for zero rudder pedal deflection and then subjected to 
a deadzone of ±*300 volt dc. From here the signal is shaped with a first- 
order lag circuit with a break frequency of 5.0 radians per second. This 
signal is then scaled up by a gain of 1.260 volts dc per volt dc and summed 
with the trim signal and equalization circuit. This composite signal is 
then command limited to ±20.7 degrees of rudder surface deflection. From 
here this signal is compared with the other two channels for monitoring 
purposes and middle value selection. The middle command value is then 
limited to ±10.0 degrees of rudder deflection if the wing is down. A 
discrete signal is provided by one of the three Independent wing position 
switches located under the wing. If the wing is up, the signal is not 
limited and the entire Blgnal is passed through to the closed loop servo 
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drive, which is scaled at 2.1 degrees of rudder deflection per volt. The 
linearised mathematical equation from the rudder pedal to the rudder when 
the wing is down is as follows: 


R 

Pedal 


(•>" ^)('-S£)(ri%r)(rb)f’> **)(■•• 8*5?) 


When the wing is up the following equation is used: 

A- ' 8=5?) 


The pilot can manually trim the rudder with full surface authority at a rate 
of .484 degree (.231 V dc) per second. Equalization is provided to null out 
offsets between channels. This signal has a maximum rate of .396 degree 
(.189 V dc) per second and nulls out any steady state error between that 
channel and middle value command greater than .827 degree (.393 V dc). 

These voltages are measured at the point where the yaw closed loop servo 
receives the wing down limited signal (figure 6). 

Pitch Computer Bypass System Surface Command 

Three LVDT signals controlled by the pilot's control stick are delivered 
to the appropriate pitch channels in the backup and servo control system 
(figure 7). This signal has a nonlinear parabolic shape (figure 12). The 
backup and servo control system demodulates this signal with a scale factor 
of *800 volt dc per volt rms with a first-order lag effect which has a break 
frequency of 151 radians per second. This signal is then nulled to a 0 de- 
gree elevator command for a zero pitch stick deflection and then subjected 
to a deadzone of ±.176 volt dc. From here the signal is shaped with a 
first-order lag filter with a break frequency of 5.0 radians per second. 

This signal is then scaled up by a gain factor of 1.76 volts dc per volt dc, 
and summed with the trim command, equalization circuitry, and wing position 
input. The wing position input is scaled so that the elevators are offset 


29 


8 


7k 



13 12 11 10 9 8 7 6 5 4 3 2 10 123456789 10 11 

CENTIMETERS 


Figure 12. Pitch stick command in V ac versus pitch stick displacement 
in channel A. 
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from 5 degrees leading edge down for a wing down condition, and to 0 degrees 
for a wing up condition. This composite signal is then command limited to 
24.8 degrees of elevator leading edge down, or to S.57 degrees of leading 
edge up travel. From here the signal Is divided into two parallel paths for 

left and right elevator commands. These signals are compared with the sig- 

nals from the other two channels for monitoring purposes and middle value 
selection. The middle value then drives the surfaces at approximately 2.40 
degrees per volt (figure 13). The linearized CBS scaling from control stick 
to elevator is as follows: 

_ ( Vrms l ( .800 V dc \ / 151 \ / 5 \ /, V dc\ ( , / n Deg_\ 

Pitch Stick \cmj\ Vrms J \S + 151 J \ S + 5 J l' * /D V dc J V V dc J 

♦Figure 12 gain gradient 

The pilot can manually trim the elevator with full surface authority at a 
rate of 1.19 degrees (.497 V dc) per second. Equalization is provided to 
null offset errors between channels. This signal has a maximum rate of .454 
degree (.189 V dc) per second and will null out any offset errors greater 
than .943 degree (.393 V dc). The voltages are measured at the input to the 
pitch closed loop servo drive (figure 7). 

Roll Computer Bypass System Surface Command 

Three LVDT signals controlled by the pilot's control stick are delivered 
to the appropriate roll channels in the backup and servo control system 
(figure 8). This signal has a scale factor of .732 volt rms per centimeter. 
The backup and servo control system demodulates this signal with a scale 
factor of 1.00 volt dc per volt rms and also has a first-order lag effect 
with a break frequency of 151 radians per second. This signal is then 
nulled out to a 0 degree surface command for zero roll stick deflection and 
then subjected to a deadzone of ±.176 volt dc. The signal is then shaped 
with a first- order lag circuit with a break frequency of 5.0 radians per 
second. This signal is then scaled by one of two scale factors, depending 
upon whether the wing is up or down. This scale factor is .537 volt dc per 
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volt dc for a wing down condition and 1.075 volts dc per volt dc for a wing 
up condition. This signal Is then summed with the trim command and equali- 
zation circuit. The signal Is then split Into two parallel paths, one for 
the left aileron actuator and one for the right. Wing position Is added to 
the left hand signal and subtracted from the right* The wing position sig- 
nal is scaled so that when the wing Is up, both aileron surfaces droop 20 
degrees from an Initial 0 degrees for a wing down condition. This composite 
signal Is then command limited to 13.9 degrees of trailing edge up, or to 
42.9 degrees of trailing edge down travel. This signal Is then used with 
the signal from the other two channels for monitoring purposes and for 
middle value selection. The middle value then drives the secondary actuator 
with a scale factor of 4.5 degrees per volt dc. With the wing up, the 
linearized mathematical equation from the pilot's control stick to aileron 
surface Is as follows: 


Mlfua ■ (- 732 ^r) (’ 00 7 ^)(s-t!tt) (s4t) (- 537 


With the wing up, the equation is as follows: 


Ron'ttuk • (- 732 (’- 00 wsf) (s-rk)(s4r) ('•° 75 Hf )( 4 - 5 rfc) 


The pilot can manually trim the aileron surfaces with full surface authority 
at a rate of 1.49 degrees (.332 V dc) per second. Equalization is provided 
to null out offsets between channels. This signal has a maximum rate of 
.851 degree (.189 V dc) per second, and will null out any steady state error 
between that channel and middle value command greater than 1.77 degrees 
(.393 V dc). The voltages are measured at the Input to the roll closed loop 
servo drive. 
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Computer Bypass System Redundancy Management 


CBS surface command monitoring Is similar to DCS surface command moni- 
toring In that electronic comparators (with identical trip levels) are used 
to detect mismatches between channel command and middle value command* How- 
ever, since the CBS system is the backup system, no downmodlng is provided* 
Therefore, If two or three electronic comparators for a particular command 
path (left pitch, right pitch, left roll, right roll, or yaw) detect fail- 
ures, that path Is disabled. For example. If one left pitch electronic 
comparator trips, two good channels remain, and the only action is that the 
electronic warning light for that channel lights up. However, if two left 
pitch electronic comparators trip, the correct surface command is undeter- 
minable. Then all three of the left pitch MVL outputs are disabled and all 
of the pitch electronic warning lights light up. Disabling the output of 
the MVL would cause the left elevator to return to 5 degrees leading edge 
down and remain there as long as the actuator is engaged. (Disabling a roll 
MVL or yaw MVL would cause the surface to return to 0 degrees.) 

I 

Trim runaway protection is also a feature of the CBS. If for some rea- 
son a false trim command between the trim switch and the backup and servo 
control system occurs, the pilot simply pushes the control stick or rudder 
pedal (whichever axis the false trim command is coming from) far enough to 
overcome the deadzone (+.176 volt dc for the pitch and roll axis, ±.300 volt 
dc for the yaw axis), and the trim logic circuitry automatically disables 
the trim circuit for that axis. The trim warning light on the status/engage 
panel for that axis lights up, indicating to the pilot that the trim circuit 
is disengaged. The pilot has the option of resetting this circuit by press- 
ing the trim warning light. 

SERVO REDUNDANCY MANAGEMENT AND ENGAGEMENT INTERLOCKS 

As mentioned in the section entitled GENERAL SWITCHING CONFIGURATION, 
the five actuators are engaged through the switches located on the status/ 
engage panel. The following discussion covers the criteria that must be met 
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for a channel to be engaged and stay engaged. It should be noted that both 
manual and auto engagement are independent of the CBS or DCS mode. 

Auto Engagement 

Certain criteria must be met before a channel can be put into the auto 
mode. The criteria and sequence of events that occur after the servo engage 
switch is placed in auto are as follows: the backup and servo control sys- 

tem for that channel checks to see that at least one servo comparator from 
one of the other two channels is valid and that its own servo comparator is 
valid. Simultaneously, it checks the validity of its own power monitor and 
makes sure that a manual engagement from one of the other two channels has 
not been selected. If these criteria have been met, an engage signal is 
sent to the secondary actuator solenoid for that channel. The same criteria 
are used for all three channels. After the channel has been engaged, the 
solenoid is automatically disengaged if the above criteria have not been 
met. The return path from the solenoid is monitored for the proper amount 
of current. If the current is greater than .49 amperes and an engage signal 
is sent to the solenoids, the servo light for that channel goes out to indi- 
cate to the pilot that the servo is engaged. The pilot may attempt to reset 
the servo comparators by pressing the servo light, which is also a momentary 
contact switch. 

The power monitor is set to trip whenever the voltages used in that 
channel exceed 15 V dc ± 3 V dc, -15 V dc ± 3 V dc, 10 V ac ± *654 V ac , or 
-10 V ac i .654 V ac ; or if the 28-V dc supply drops below 19.2 V dc* The 
power monitor valid signal is cross monitored between each channel. If two 
power monitors trip, the remaining good channel locks into a mode similar to 
single channel manual engage operation. Although auto is still engaged, the 
remaining good channel provides a priority interrupt which overrides the 
electronic MVL and servo comparator solenoid disable logic. This interrupt 
signal also disables the AP equalisation feedback and forces the electronic 
MVL to single channel operation. All the electronic warning lights (pitch, 
roll, and yaw) are illuminated for each channel that has a power monitor 
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failure* The pilot may attempt to reset the power monitor by pressing one 
of the illuminated electronic warning lights* If the reset is successful, 
and if all the other criteria for auto engagement are met, the system 
resumes normal auto operation. 


Manual Engagement 

Manual engagement for a particular channel is a means of selecting 
single channel operation. Engaging this mode prevents the other two chan- 
nels from engaging either the auto or the manual mode* Manual engagement 
overrides the electronic MVL and servo comparator solenoid disable logic* 
Manual engagement also disables the AP equalization feedback and forces the 
electronic MVL into single channel operation. 

Servo Disengagement 

If failures occur which would disable all three channels of a servo 
actuator - for example, two servo comparators trip, or the pilot elects to 
manually disable all three channels for a servo actuator - centering springs 
drive the secondary actuator to a predetermined point* This point corre- 
sponds to 10 degrees trailing edge down for an aileron surface, 2.5 degrees 
leading edge down for an elevator surface, and 0 degrees for the rudder 
surface. 


SELF-TEST OPERATION 


Preflight self-test is designed to verify the flight control system be- 
fore taking off. It Is not functional while the aircraft is airborne; 
therefore, the engagement of the preflight self -test is interlocked with 
both the weight-on-wheel switches. The preflight self-test can be initiated 
only when the weight -on-wheel switches are closed, which occurs when the 
aircraft is on the ground. 
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Since the preflight self-test for pitch, roll and yaw are fully inde- 
pendent of each other, any axis can be tested separately. The servo 
switches of the axis to be tested are set to auto on the status/engage 
panel, with the servo switches of the other two axes off. The preflight 
self-test will not function properly if the servo switches of more than one 
axis are engaged. The normal sequence for a complete three axis checkout 
will be pitch axis, roll axis, and yaw axis. 

To start the preflight self-test, turn the lever locked power switch in 
the self-test section on the status/engage panel to on and depress the DIR 
switch of that axis under test on the mode and gain panel. Also, reset the 
PEM indicator of that axis on the status/engage panel. Momentarily depress 
the push-to-start switch under the switch guard. If the pitch axis is 
selected, all the lights in the preflight self-test section on the status/ 
engage panel will be turned on while the push-to-start switch is depressed. 
This serves as the lamp test function at the beginning of the self-test. If 
the roll axis is selected, only counter lights 32 and 8 and the on light 
will be turned on while the push-to-start switch is depressed. If only the 
yaw servos are engaged in the auto position, counter lights 64 and 16 and 
the on light will be turned on while the push-to-start switch is depressed. 

The preflight self-test starts automatically as soon as the push-to- 
start switch is released. It sequences through the tests as the counter 
advances if no failure is detected. At the end of the test of that particu- 
lar axis, the amber on light will go off, and the green pitch or roll or yaw 
light (depending on the axis being tested) and the go light will come on to 
Indicate that the test has been successful. Test numbers 0 through 39 are 
allocated for the pitch axis; 40 through 79 are for the roll axis; and 80 
through 111 are allocated for the yaw axis. 

If a failure is detected during self-test, the on light goes off and the 
counter stops. The self-test circuitry latches and the red diagnostic 
lights come on to indicate that the failure is in either the left or the 
right servo or in the electronics. The lights also Indicate which channel 
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and which axis the failure Is In* From the failed test number, the diagnos- 
tic lights and the preflight self-test table (appendix A), the ground main- 
tenance crew can easily Identify the failed area. Turning the power switch 
off Is the only way to reset the self-test. 

Figure 14 Is a block diagram for the digital fly-by-wire flight control 
system preflight self-test. 


SYSTEM DESIGN FEATURES 
PILOT OONTROL INPUTS AND PROCESSING 

The CBS design permits a limited amount of flexibility in adjusting 
shaping filters, gains, deadzones, and limiting circuitry. This was 
necessary in order to integrate the CBS with the characteristics of the 
aircraft input sensors and actuators after initial installation. 

The primary purpose of the deadzone circuit incorporated in pitch, roll, 
and yaw servo control paths (figures 6, 7, 8) is to reduce the effects of 
control stick and rudder pedal centering errors. A secondary purpose, dis- 
cussed in Servo Equalization and Monitor Design, is to reduce the trans- 
mission of unwanted high-gain low-level signals. The deadzone must be large 
enough to compensate for mechanical centering errors to prevent nuisance 
trim disable trips from occurring. The rudder pedal deadzone was increased 
to ±.300 V dc (±13. 2% surface) because of the mechanical linkage tolerance 
between the pedals and the LVDT sensors located in the tall of the aircraft. 
A ±.100 V dc deadzone for the pitch and roll axes proved to be sound for 
mechanical centering errors. However, it was discovered after the first two 
flights that on takeoff and during certain maneuvers the pilot intentionally 
pulled the stick out of the deadzone and gave a trim command in the opposite 
direction, which automatically disabled the trim circuit. Therefore, the 
deadzone was increased to ±.176 V dc for the pitch and roll axes. T is 
deadzone corresponds to ±4.5% of pitch surface level, and ±5.7% of roll 
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surface travel (wing up). The trim logic dropout time constant was In- 
creased from .160 seconds to .490 seconds. Widening the time constant has 
two effects; It allows for beep trimming, and, if a trim runaway occurs it 
takes Just that much longer before the trim circuit Is disabled. The delay 
would correspond to an Increase of .190 to .583 degree of elevator surface 
travel and .238 to .730 degree of aileron surface travel. If this continues 
to be a nuisance, a hardware change would be In order. The change should 
separate the deadzone and the trim detent detector in such a way as to make 
it possible to adjust the trim detent circuit without affecting the deadzone 
circuit. 

The limiting circuit incorporates temperature compensated zener diodes 
which have a .01 percent error drift per degree centigrade temperature 
change. Although these limiters are temperature compensated, they still 
have a 5 percent value tolerance. Therefore, they were placed in front of 
the MVLs so that the three channels could be scanned and the middle value 
selected. The limiting values were selected to give 95 percent to 98 per- 
cent of the full mechanical limit of the secondary servo actuators. This 
limiting circuit is necessary to prevent bottoming-out of the secondary 
actuator ram and consequent trips of the comparator. The bottoming-out 
creates trips because of transients resulting from the difference in the 
pressure characteristics between channels. 

DIGITAL SYSTEM INPUTS AND PROCESSING 


Flexibility in gain changes are not provided for the DCS surface com- 
mands since it is assumed that gain changes can be accomplished under soft- 
ware control. The second-order, low-pass filter does have adjustment 
capabilities. This filter is provided to reduce the unwanted noise that was 
seen during the checkout of the breadboards. The limit circuit was dupli- 
cated for the same reason as stated for the CBS. The limit is also adjust- 
able and should agree with the CBS limit value. 
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The CBS/DCS switch and the synchronlzatlon/equallzatlon switch are both 
solid state switches. No relays are used In the backup and servo control 
sys tern. 


COMPUTER BYPASS TRIM SYSTEM 


The computer bypass trim system Is implemented by inputting a beep trim 
input from a stick-mounted pushbutton into a digital integrator* The output 
of the Integrator is summed with the stick input to command elevator dis- 
placement* The trim implementation is illustrated in figures 6, 7, and 8 
for yaw, pitch and roll axes* 

The beep trim integrator has a digital rather than an analog implementa- 
tion due to the requirement that aircraft trim must be held on this inte- 
grator over long periods of time. This digital implementation has no long 
teem drift characteristics, whereas any analog Integrator has a finite long 
term drift rate* The Integrator is also used in channel equalization and 
synchronization in the DCS mode. 

The digital integrator implementation utilizes an 8-bit up/down counter 
as the memory element. The digital-to-analog conversion of the counter out- 
puts yields a resolution of one least significant bit or approximately 90 
millivolts. This resolution is equivalent to .386 degree in roll, *206 de- 
gree in pitch, and .180 degree in yaw. This resolution results in a notice- 
able granularity in surface movement when trim is being used. Also, the 
trim resolution in roll is such that small vernier adjustments to aileron 
trim are difficult to accomplish. An obvious solution to the above problem 
was to increase the resolution of the digital Integrator by Increasing the 
number of bits in the up /down counter to 9 or 10. However, because of 
physical space constraints in the hardware, this solution was not feasible 
without a major system redesign. Another possible solution would seem to be 
a reduction of the trim authority (trim rate and authority are adjustable); 
thereby Increasing the Integrator digital to analog resolution. However, 
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channel equalization and DCS synchronization are also accomplished using the 
digital Integrator. Synchronization of the CBS to the DCS when flying In 
the DCS mode requires that the synchronization integrator be able to syn- 
chronize over the full range of surface authority. Any reduction of trim 
authority would also reduce the synchronization authority. Reducing syn- 
chronization authority could result in unacceptable surface transients when 
a system downmode from DCS to CBS occurs. It is apparent that increasing 
the resolution of the trim integrator by reducing the trim authority is an 
unacceptable solution. 

The CBS detent detector is set to detect any stick or rudder pedal de- 
flection greater than the CBS deadzone. The trim logic compares this detent 
with the trim command. If the trim command and detent detector disagree, 
then the trim circuit is automatically disabled and the trim warning light 
lights up. The trim logic latches up ir. the disabled position and the stick 
or rudder pedal can be released. This logic is resettable by the pilot. 
Since the CBS stick and rudder pedal deadzone is small, a .490 second drop- 
out delay was necessary to allow for beep trimming in the opposing direction 
of the stick. 


COMMAND CHANNEL EQUALIZATION AND SYNCHRONIZATION 

The equalization circuit forces the CBS trim rates for the three chan- 
nels to follow each other within the boundaries of the equalization deadzone 
(+.393 V dc error between channel command and MVL output). It does this by 
adding or subtracting from the trim rates up to a maximum of ±.189 V dc per 
second. 

Synchronization has a faster rate and is used to reduce surface tran- 
sients when downmoding from DCS to CBS. Equalization is used to null out 
any steady-state errors between channels while in the CBS mode. Synchroni- 
zation is always engaged for a DCS mode regardless of whether the CBS/DCS 
switch is in the DCS or CBS position. Equalization is always engaged for 
the CBS mode. 
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One of the tradeoffs Involved In using the synchronization scheme to 
reduce surface transients Is that the voltage In the synchronization 
equalization circuit needed to reduce surface transients, when downmodlng 
from DCS to CBS becomes a steady-state voltage for the CBS* For instance, 
if the pilot is using the side stick when a downmode occurs, the side stick 
command as seen at the time of the downmode remains in the synchronization/ 
equalization circuit* This command must then be trimmed out by the pilot in 
order to return to a state of equilibrium. 

COMMAND CHANNEL VOTING 

Each MVL has three modes of operation which are controlled by logic* 
These modes are: middle value selection, single channel operation, and 

output disable. 

The purpose of middle value selection for triplex operation is to select 
a single value for the three channels of the closed loop servo drive. With- 
out a single value being selected, any difference between channels could 
cause reduced servo performance, pressure force fights, and possibly servo 
actuator disengagement (depending upon the level of pressure force fights). 
The MVL also reduces single channel spiking and prevents passive and hard- 
over failures from getting through to the closed loop servo drive. It can 
do this because as soon as a faulty channel, if it is middle value, crosses 
over another channel value, it is voted out and the other channel is 
selected. 

Single channel operation occurs if manual engage is selected for that 
channel, or if power fails in the other two channels. 

The output is disabled if two or three electronic comparators for that 
channel do not track. 
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COMMAND CHANNEL REDUNDANCY MANAGEMENT AND MODE CONTROL 


All comparators were designed with adjustable trip levels and time de- 
lays. These trip levels and time delays are given in table 2. The elec- 
tronic and PEM operators readily detect single channel hardover conditions, 
passive failures are more difficult to detect since the comparators require 
a level of mismatch. This mismatch corresponds to a surface command equiva- 
lent to the trip level given in table 2. Presently, the trip levels are the 
same as they were for phase I, except for that for the roll electronic com- 
parator, which was reduced by 15 percent. 

A 40-millisecond delay was designed into the logic when downmoding from 
DCS to CBS to reduce nuisance downmoding. A 15-millisecond delay was de- 
signed into the system prior to the one-shot resetting of the electronic 
comparators. This delay was necessary to prevent a possible CBS-DCS mode 
mismatch after downmoding from DCS to CBS. For example, assume that channel 
A and channel B electronic comparators have just tripped while in the yaw 
DCS mode. Normal operation would call for all three channels to downmode to 
CBS in 40 milllseccuds. However, due to tolerance effects, assume that 
channel A downmodes first and resets its electronic comparator before chan- 
nel B and channel C complete their downmodes to CBS. For this case, channel 
B and channel C would stop downmoding, since now only channel B has an elec- 
tronic comparator tripped (it takes two tripped electronic comparators to 
downmode to CBS). The modes would now be channel A ■ CBS, channel B - chan- 
nel C ■* DCS. Because of this situation, a 15-millisecond delay was added to 
ensure that all channels are downmoded to CBS before the electronic 
comparators are reset. 


44 


TABLE 2. ELECTRONIC AND PEM COMPARATOR TRIP LEVELS 


Comparator 

Trip Level 

Time Delay 

4V dc ^Surface degrees 

Roll Electronics, Left and Right 

2.43 ± .17 10.94 ± .77 A 

200 msec 

Pitch Electronics, Left and Right 

2.84 * .20 6.82 ± *48 E 

200 msec 

Yaw Electronics 

2.84 A .20 5.96 * .48 R 

200 msec 

Roll PEM 

2.84 * .20 12.78 ± .90 A 

400 msec 

Pitch PEM 

2.84 ±20 6.82 ± .48 E 

400 msec 

Yaw PEM 

2.84 ± .20 5.96 ± .42 R 

400 msec 


SERVO ENGAGE INTERLOCKS 

Each channel of the secondary actuator has Its own hydraulic supply: 
the two primary and single utility hydraulic systems. It should be pointed 
out that the primary (surface) actuator Is supplied from only the two pri- 
mary hydraulic systems standard for this aircraft. Therefore, failure of 
the two primary hydraulic systems would disable all primary surface 
actuators. 

The original phase II design allowed a tolerance of up to SO milli- 
seconds of disengagement time between the two on channels. It was found 
during ground check that when a second failure was detected by the servo 
comparators, timing was critical for disengaging the remaining two channels. 
Excessive disengagement time caused large surface transients. For example. 
If a hardover failure occurs In one of two remaining channels, and the valid 
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channel Is disengaged first [assuming a roll actuator with a slew rate of 
38.1 cm (15 Inches) per second], the following transient could be expected: 


(.05 second) ( Second ^ " 22,5 degree transient 

This tolerance was tightened up for a maximum of 5 milliseconds of delay 
between disengagements* 

The normal procedure for the first servo-comparator-detected failure is 
for the pilot to attempt to reset this comparator. If the reset is unsuc- 
cessful, he switches that channel off. If a second failure occurs, all 
channels for that actuator are switched off. No attempt should be made to 
engage manual, or to reset the comparators after two failures, since this 
could cause a hardover state. 


SERVO CONTROL SYSTEM DESIGN 


The design of the secondary actuator servo control system vas arrived at 
via the analysis, simulation, and testing of the flyable hardware in the F-8 
iron bird mock-up. Analysis was used to establish and verify the adequacy 
of position and pressure loop gain and phase margins. Simulation using a 
linear model for the servovalve was used to perform system time history re- 
sponses and arrive at the desirable Initial values for the monitoring system 
design. Testing in the iron bird mock-up provided the opportunity for per- 
formance verification and optimization in a realistic operating environment. 
Under these conditions the impact of servovalve nonlinearities and aircraft 
hydraulic characteristics was ascertained, and refinements to the design 
were Introduced as performance requirements dictated. These investigations 
resulted in the secondary actuator servo system design shown in the transfer 
function block diagram in figure 15. 
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Position Loop 


The position loop was designed so that at 20 Hz the closed loop response 
had a normalized gain of +3 decibels and a phase lag of less than 90 

c mVsecond 

degrees. Given a valve flow gain of 1.07 x 10"° ^ * 

• 65 inch 3 /second „ , 

a piston area of approximately 1.68 x 10 “^ (.26 

inch^), and an LVDT scale factor of 197 volts rms/m (5 volts rms/inch) ; a 

maximum feedback gain of 1476 ma/m (37.5 ma/inch) from RAM position to servo 

amplifier output was found to be acceptable. This resulted in a total loop 

gain of 93.5 per second, which when combined with the dynamic effects around 

the position loop produced the Bode plot in figure 16. The position loop 

dynamics, as indicated in figure 15, includes a two stage roll-off filter to 


reduce 800-hertz demodulator ripple, a servo amplifier lag filter associated 
with stabilizing the servo amplifier, and the second order approximation to 
the servovalve dynamics. The gain and phase margins measured from figure 16 
are 10 db and 53 degrees, respectively. The gain margin meets the typical 
servo design objective, while the phase margin is 7 degrees less than the 
normal design goal of 60 degrees. However, since the phase II hardware was 
derived from the "in-place" phase I F -8 secondary servo actuator design, it 
was concluded that this slight reduction in phase margin did not warrant the 
cost of raking any hardware module design modifications. A 2 db reduction 
in the .electronic feedback gain would have yielded the desired phase margin. 
However, this would have been accomplished at the expense of Increased 
sensitivity to valve and actuator nonlinear it ies vriien the pressure loop was 
closed. This was deemed to be an undesirable trade-off, and hence the lower 
phase margin value was considered to be acceptable. This is supported by 
the ac.uator step responses illustrated in figure 17 where it is seen that 
the peak overshoots are well within desirable limits (less than 10 percent). 
A corresponding closed loop Bode plot is presented in figure 18. This plot 
atvi step responses of figure 17 were obtained on the F -8 iron bird mock-up. 
The relative gain of 0 db and -73 degrees of phase at 20 Hertz are well 
within the design requirements. On-line performance evaluation as well as 
off-line analysis has shown that the basic servo loop stability and step 
response is essentially independent of pressure equalization loop closure. 
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DEGREES 




The step responses of figure 17 support this conclusion, and correlate well 
with a relative damping ratio projection of .6 to .65 that is predictable 
from the Bode plots of figures 16 and 17. 

Servo Equalization and Monitor Design 

Description .- The equalization and monitor functions for the secondary 
actuator system, described previously in Servo Actuator Engagement, are 
shown in figure 15, which is an idealized representation of the actual servo 
electronic circuitry. This figure represents the functional characteristics 
of the servo system which were included in the simulation. For each of the 
force summed servos, the pressure sensor signal is filtered, amplified, 
limited and finally fed to a deadzone circuit. The signal from the deadzone 
circuit is applied to a MVL input terminal, then subtracted from the MVL 
output to provide the input to an equalization lag circuit. Following 
filtering (one-second lag), amplification and limiting in the equalization 
lag circuit, the equalization signal is summed with the servo position com- 
mand. The monitor consists of a comparator circuit which compares the dif- 
ference between the limited and buffered pressure sensor signal and the MVL 
output. 

These equalization circuit functions provide the means to change any 
servo channel pressure towards the mid-value pressure corresponding to the 
MVL output. The channel or channels corresponding to the mid-value pres- 
sures are not affected; only those channels differing from the raid-value 
pressure have non-zero equalization feedback signals. Similarly, the 
monitor reading will be zero for channels corresponding to the mid value 
pressures since in such a case MVL outputs will equal input. For a sudden 
change in the position signal to only one servo, piston pressures will first 
increase, then reduce in magnitude with time. This is due to the equaliza- 
tion of the differences between servo channel pressures. The exact charac- 
teristic will depend upon the time history of the position signal, pressure 
and position loop gains, and the lag time constant in the equalization feed- 
back path. 


52 


Objectives .- The major objective of servo equalization is to make fault 
monitoring feasible. Other advantages include Improved tracking performance 
in two-channel operation. 

Unless some means exists to automatically detect and isolate a failure, 
the triplex secondary actuator configuration cannot be justified. Only if 
automatic disengagement of the faulty channel occurs will the reliability 
and safety requirements be met. Experience has shown that most failures in 
a force summed servo system will cause unequal and opposing forces across 
the individual hydraulic pistons. This fact has encouraged widespread use 
of a fault monitoring technique based on servo piston force measurements, 
utilizing simple pressure sensors. The drawback has been that, without 
equalization, typical servo and electronic circuit tolerances can also re- 
sult in the force-op position condition, even when no failure is present. 

The equalization path, as described above, has the property of forcing the 
pressures to the same level for normal tolerance spread. Changes in signal 
levels due to faults (changes in excess of the normal system tolerance) will 
result in exceeding the comparator trip limit and disengagement of the 
faulty channel. 

The requirement to equalize pressures for monltorablllty is of partic- 
ular importance in a secondary actuator design such as the F-8, which uses 
servovalves having a high nominal pressure gain of 68.9 x 10^ N/m* per 
mllllampere (10,000 psl per milliampere) • For example, a channel unbalance 
equivalent to only .3 ma of the servo amplifier could cause a maximum force 
to be realized at the piston of this particular channel. 

Lack of equalization tends to degrade performance during two-channel 
operation. Given the case where the aircraft is in a trimmed flight condi- 
tion and the two servo position commands lie on opposite sides of zero, the 
output will remain at zero until either of the commands passes through zero. 
Low level oscillations can result. Addition of equalization essentially 
eliminates this problem, since the effect is to force both servo amplifier 
output signals together. 
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Final Adjustments *- The selected values of the equalization circuit 
parameters were established with the actual hardware, under operating con- 
ditions* Parameters, varied to provide optimum fault detection capability, 
Included equalization loop gain, lag time constant, monitor trip level, 
monitor trip time delay, equalization rate and authority, and equalization 
circuit deadzone. 

Two system nonlinearities tended to degrade monitoring performance: the 

three hydraulic supply systems exhibit severe pressure/flow mismatch under 
large dynamic flow conditions, and the secondary actuator servovalve is 
characterized by extremely high gain about the zero flow region* Ratcheting 
and granularity effects resulted from the servovalve nonlinearities for low 
level dynamic signals* Poor pressure tracking between pistons resulted from 
the supply pressure mismatch condition. 

The solution to the low-level ratcheting problem was to increase the 
deadzone region to one-half the channel trip level. This opens the equali- 
zation path for low-level signals which are below monitor thresholds. In- 
corporation of the deadzone results in improvements in the position response 
for low-level inputs over the zero to two hertz frequency range, without 
compromising fault detection capability. 

Increases in equalization loop gain and selection of a .4 second monitor 
trip time sufficed to resolve the nuisance trip problem resulting from 
hydraulic system mismatch. This ensured that no nuisance trips would result 
when cycling the servo, stop-to-stop, at a frequency of one hertz, with a 
peak current mismatch of one milliampere between channels. Pressure loop 
bandwidth is illustrated by the Bode plot in figure 19. This is a plot of 
open loop amplitude/phase versus frequency for the total linearized pressure 
loop in figure 15. The zero decibel crossover at 67 radians per second 
attests to the large pressure loop bandwidth required. Equalization feed- 
back without lag filtering would tend to mask failures; the lag filter is 
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rate limited to ensure that high frequency faults will not be equalized out« 
Lag time constant values in excess of one second were found to aggravate the 
nuisance disengage problem* 

It may be noted from figure 19 that the gain and phase margins are 13*7 
decibels and approximately 60 degrees, respectively. These margins are con- 
sistent with a stable pressure loop design, and were found to be necessary 
for minimizing pressure-to-position loop coupling. 

Equalization feedback authority is limited to 13.5 percent. This value 
is a compromise between the requirement to minimize aircraft transients due 
to failures, and the need to provide equalization of anticipated static 
nulls, offsets, and dynamic channel mismatches. 

In order to detect a fail-to-zero condition of any LVDT position sensor, 
it is required that the loss of the LVDT signal create a pressure change 
sufficient to trip the monitor. The critical condition corresponds to a 
trimmed surface, vhich is the most likely situation. Rather than rig the 
LVDT to produce zero volts for this trimmed condition, which could result in 
a passive failure, the LVDT is rigged to provide a small signal for no com- 
mand input. The resulting servo amplifier bias signal is balanced out by 
appropriate adjustment of the servo amplifier balance potentiometer. 

SELF-TEST DESIGN PHILOSOPHY 

The design philosophy of the preflight self-test for the phase II digi- 
tal fly-by-wire computer bypass system is different from that used in phase 
I. In the phase I system, if a self-test in the yaw axis was desired, it 
was necessary to first complete the pitch and the roll axes before initi- 
ating self-test in the yaw axis. In phase II, this feature was redesigned 
so that each axis could be started independently from the other two. 

In addition, the monitoring points were increased from eight per channel 
(pitch electronic status, pitch loft servo status, pitch right servo status, 


roll electronic status, yaw electronic status, and yaw servo status) as In 
phase I to sixteen per channel. The pitch and roll electronic status in 
phase I was changed to pitch left, pitch right, roll left, and roll right 
electronic status* Furthermore, pre-engage monitor and trim monitor for 
pitch, roll, and yaw were added In phase II* 

Finally, a self-test binary counter indicator was added on the panel for 
easier failure isolation. 

In every test, the first half cycle is used to reset all the comparators 
(monitoring points) in all three channels unless there is a zero (0) in the 
self-test stimulus No. S Inhibit Master reset column (appendix A). A zero 
in the Inhibit Master Reset column for that test means that the test result 
from the previous test shall be carried to the present test. Combining the 
carryover test result with self-test stimuli No. 1 through No. 4 (zero means 
apply stimulus) to be applied to the appropriate channel during the second 
half cycle of the test, the expected test results could be yielded at the 
examination period at the end of the test. 

At the beginning of the second half of each test, the stimuli stored in 
the read-only memory are enabled and applied to the appropriate places. 

After a short delay, the responses of all the monitoring points (compara- 
tors), are selected through a two-stage multiplexer (the first stage selects 
the axis, the second stage selects the desired monitoring point) to pick up 
the desired monitoring points. These points are then compared with the pre- 
dicted test results. If the status of the selected monitoring points agrees 
with the predicted test results, the test counter passes the examination 
gate at the end of that test and advances to the next test. If the status 
of one or more of the selected monitoring points disagrees with the pre- 
dicted test results, the failure result with the highest priority (PIM 
first, then channel A, B, and C) is strobed into a latch. The amber self- 
test on light is turned off and the counter stops. The proper red diagnosis 
lights come on based on the information strobed into the latch, the test 
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number in the counter, and the monitoring points selecting information 
stored in the read-only-memory. 

The magnitude of the self-test stimuli for all three axes in the DCS 
mode is equivalent to 40 percent of the maximum authority. In the CBS mode, 
the magnitude of the stimuli is 32.9 percent in the pitch axis, 28 percent 
in the roll axis and 50.7 percent in the yaw axis. 

A table which lists the status check for every comparator is included as 
appendix B. 


HARDWARE DESCRIPTION 


BYPASS AND SERVO ELECTRONICS 


The CBS components that provide the buffering, bypass, monitoring, and 
servo electronic functions consist of three identical BSE assemblies. Each 
assembly measures 10.4 x 27.2 x 11.4 cm (4*1 x 10.9 x 4.5 inches) and weighs 
3.45 kg (7.6 pounds). 

Each LRU's components are located in 11 plug-in cards; one card is fas- 
tened in the power supply. Each unit was subjected to operational, vibra- 
tion and temperature tests before being shipped. The operational test was 
conducted with SFS computerized automatic test equipment. 

Twenty-eight-V dc power is used in the logic for this system and is con- 
verted to £15 V dc and 5 V dc for the analog portion of the system. A cur- 
rent of 1.4 amperes is drawn from the 28-V dc bus. The 26-V ac supply is 
routed into the BASE box and back out again for primary power to the control 
stick and rudder pedal LVDT's and secondary actuator position LVDT's. The 
26-V ac supply is converted to in- and out-of-phase 10 V ac for reference 
use in the BASE box. 
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One dedicated connector on each unit is provided to bring out critical 
teat points. These test points are used for telemetry monitoring* system 
preflight, and maintenance testing* 

The BASE system was packaged in such a way as to split up left and right 
pitch and roll functions onto separate cards. This was done to prevent two 
failures from disabling both left and right aileron or elevator surfaces. 
Single functions common to the pitch and roll axes, such as CBS and DCS in- 
put points, were also split up onto separate cards. Other single functions 
such as the power monitor had logic designed so that no two primary power 
failures would disable all surfaces. There is no dual function in the yaw 
axis, and it was stipulated by NASA that the aircraft be flown safely with a 
failed rudder actuator. 

Figure 20 is an outline of the bypass and servo electronics assembly. 

STATUS /ENGAGE PANEL 

Figure 21 shows the front layout and the Inside view of the status/ 
engage panel. The panel measures 14.5 x 38.1 x 15.2 cm (5.7 x 15 x 6 
inches) and weighs approximately 6.35 kg (14 pounds). The status/engage 
panel used in the phase II DFBU is a modification of the panel used in phase 
I. The modification consisted of removing all the indicators and switches 
related to channel 1, changing all the legends from channels 2, 3, and 4 to 
channels A, B, and C, adding PEM and TRIM lighted pushbutton switches and 
the associated lamp drivers and telemetry Interface circuitries, adding a 
self-test counter indicator to the preflight self-test section, modifying 
the self-test circuitries to accept 10 monitoring points per channel, and 
modifying the circuitry such that the self-test for each axis could be 
started Independently of the other two axes. 

The status indication and engage function for channels A, B, and C in 
phase II uses the same circuitry as was used in phase I for channels 2, 3, 
and 4. The status indication and reset function for trim in phase II uses 
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the circuitry originally for channel 1 in phase I. PEM status indicators 
and reset functions for all three axes are newly added to the panel, and all 
of the aseoclated lamp drivers and telemetry interface circuitries have been 
added to card A7. Due to the interchangeability of cards A7 and A8, the 
same circuitries were added to card A7 that also have been added to card 8. 

Everything related to channel 1 in phase 1 was modified or removed, 
leaving connector J1 as a dummy only. 

As mentioned in SELF-TEST DESIGN PHILOSOPHY, every change related to 
self-test from phase I to phase II was incorporated into card A2 through A5 
by modifying those cards used in phase I, which includes the self-test inde- 
pendence among axes; two stane multiplexing to select the desired signals 
from an Increased number of wviitoring points; and the added circuitries for 
self-test binary counter indicators. 
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APPENDIX A 


PREFLIGHT SELF-TEST TABLE 

The CBS self-test tables that follow provide a means for the crew to 
systematically follow the test sequence and gain an increased understanding 
of the actual operations Involved. However, reference to these tables Is 
not required to interpret the test results since failures are reported-out 
on the status /engage panel. 

As an aid In self-test table interpretation, a column-by-column descrip- 
tion for test no. 1 (pitch) in table A-l is presented below. Remaining en- 
tries follow the same format. 

TABLE A-l. SELF -TEST TABLE, TEST NO. 1 EXPLANATION 

1. Test numbers 0 through 39 are for the pitch axis only; test numbers 
AO through 79 are for the roll axis only; and test numbers 80 through 111 
are for the yaw axis only. 

2. First column identifies the test number (no. 1 in this example). 

3. Second column lists channels A, B, and C. 

4. Under the "S.T. Stimuli" (Self-Test Stimuli) heading, a 0 under #2 
in row A means salf-test stimulus #2 in channel A is activated; a 0 under #5 
Sync Disable means the synchronization between the digital primary system 
and the analog backup systems is disabled. 

5. A 1 under the "Comparator" heading means those comparators shall be 
failed based on the stimuli applied for that test. For test no. 1, POi 
shall fail, and both the "LE" (left electronics) and the "RE" (right elec- 
tronics) in channel A shall tail. 
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6* Under the heading "Monitoring Point" are the comparators that were 
selected in the corresponding channel for monitoring. "CLE" is used in 
channel A, "CLE" is used in channel B and "CRS" (right servo comparator) is 
selected in channel C for monitoring in test no. 1. 

7. Under "Function Under Test," the first row states that the monitored 
point, PEM, shall fail in both channels A and B due to the stimuli applied 
for this particular test. 

In test no. 1, #2 S.T. Stimuli was applied only to channel A, and 
the synchronization (S.T. Stimuli no. 5) was disabled. The 0 +, + 0, 0 - or 
- 0 after "F" shows the polarity which causes the comparator to fail. 

8. If the status of the comparator under monitoring does not agree with 
the status predicted, the self-test will be stopped and the failure mode 
shall be reported-out on the control panel as indicated in the last column 
"Failure Report Out." 
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TABLE A-l 


SELF-TEST TABLE 
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TABLE A-2. SELF-TEST TABLE 



PEM » Pre-Engage Monitor, C^g • Comparator Status of Left Electronic 
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TABLE A- 3 


TEST TABLE 
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APPENDIX B 


COMPARATOR STATUS CHECK TABLE FOR SELF-TEST 

The comparator status check tables that follow summarize the results of 
the tests in Appendix A. For an example, the case for "Pitch Fall 40" is 
interpreted in the following paragraphs. Other items of the table have a 
similar Interpretation. 

1. "Pitch Fall 40" mean: that the comparator should indicate a failure 
due to a positive polarity at the MVL input with respect to the voltage at 
the MVL output. 

2. "MVL Input 4-, Output 0" means that a single 4- polarity voltage is 
applied and a 0 voltage is generated at the output of the MVL. 

"MVL Input 44- , Output 4-" means that a positive hardover voltage was 
applied and the output was a lover level positive voltage. 

3. The notation "Channel A Pitch DCS 3" means that the subject compara- 
tor trip occurred in test 3 of Appendix A, resulting in a PEM failure indi- 
cation. Similarly, the notation "Channel A Pitch DCS C" means that the test 
is not performed in the DCS mode, since it is already covered in CBS mode. 
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TABLE B-3. COMPARATOR STATUS CHECK TABLE - YAW AXIS 
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utilizing the differential pressure developed across each piston. 
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